modularized deployments

demilich/configuration.nix

@@ -12,9 +12,9 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../services.nix
-    ../packages.nix
-    ../security.nix
+    ./services.nix
+    ./packages.nix
+    ./security.nix
   ];
 
   # Enable flakes and nix-command
@@ -30,7 +30,6 @@
     "electron-39.8.10"
   ];
 
-  # Use the systemd-boot EFI boot loader.
   boot = {
     loader = {
       limine = {
@@ -47,7 +46,20 @@
 
   networking = {
     hostName = "demilich";
-    networkmanager.enable = true;
+
+    networkmanager = {
+      enable = true;
+    };
+
+    nftables = {
+      enable = true;
+    };
+
+    firewall = {
+      enable = true;
+      trustedInterfaces = [ config.services.tailscale.interfaceName ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
   };
 
   # Set your time zone.
@@ -56,7 +68,7 @@
   # Select internationalisation properties.
   i18n.defaultLocale = "en_CA.UTF-8";
   console = {
-    # keyMap = "us";
+    keyMap = "us";
     useXkbConfig = true;
   };
 

demilich/hardware-configuration.nix

@@ -1,31 +1,62 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" "iwlwifi" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" "iwlwifi" ];
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "xhci_pci"
+        "nvme"
+        "usb_storage"
+        "sd_mod"
+        "rtsx_pci_sdmmc"
+        "iwlwifi"
+      ];
+      kernelModules = [ ];
+      systemd = {
+        network = {
+          wait-online = {
+            enable = false;
+          };
+        };
+      };
+    };
+  };
+
+  boot.kernelModules = [
+    "kvm-intel"
+    "iwlwifi"
+  ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/e3f1509a-7556-4eb9-ab4d-20dc2d5ff47d";
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/e3f1509a-7556-4eb9-ab4d-20dc2d5ff47d";
     fsType = "xfs";
   };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/6E60-FBDB";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/6E60-FBDB";
     fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
   };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/eaab6975-f924-485a-a84e-9d37973127ca"; }
+  swapDevices = [
+    { device = "/dev/disk/by-uuid/eaab6975-f924-485a-a84e-9d37973127ca"; }
   ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

demilich/services.nix

@@ -1,12 +1,42 @@
 { config, ... }:
 {
-  systemd.user.services.niri.enableDefaultPath = false;
+  systemd = {
+    user = {
+      services = {
+        niri = {
+          enableDefaultPath = false;
+        };
+      };
+    };
+    services = {
+      tailscaled = {
+        serviceConfig = {
+          Environment = [
+            "TS_DEBUG_FIREWALL_MODE=nftables"
+          ];
+        };
+      };
+      NetworkManager-wait-online = {
+        enable = false;
+      };
+    };
+
+    network = {
+      wait-online = {
+        enable = false;
+      };
+    };
+  };
 
   xdg.portal.config.niri = {
     "org.freedesktop.impl.portal.FileChooser" = [ "gtk" ];
   };
 
   services = {
+    tailscale = {
+      enable = true;
+    };
+
     displayManager = {
       enable = true;
       lemurs = {